-
Notifications
You must be signed in to change notification settings - Fork 16
Description
The problem I had:
-
Months ago, I interact with a repository and run
make verify-govulncheck. This installs govulncheck to~/.cache/makefile-modules/downloaded/tools/govulncheck@v1.1.4_darwin_arm64, built with go 1.24.x -
In the following months, go is upgraded to 1.25.x, but the version of govulncheck is not bumped.
-
I run
make verify-govulnchecktoday and it results in a huge swathe of errors:
...
~/workspace/cert-manager-csi-driver-spiffe/test/e2e/suite/import.go:17:1: package requires newer Go version go1.25 (application built with go1.24)
-: This application uses version go1.24 of the source-processing packages but runs version go1.25 of 'go list'. It may fail to process source files that rely on newer language features. If so, rebuild the application using a newer version of Go.The issue is that govulncheck was built with go1.24 but is testing an application using go1.25. Removing the cached version so govulncheck is rebuilt with go1.25 fixes the issue.
We could embed the go version in the cached binary name; this would mean that we'd rebuild go install dependencies when either their version, or go's version changes. e.g. we could save govulncheck as:
~/.cache/makefile-modules/downloaded/tools/govulncheck@go1.25.2@v1.1.4_darwin_arm64
(The actual format of how we embed the go version is irrelevant, though)